I've used corporate systems which made u login every visit (multiple times a day for me, 5 days a week), I've seen government systems do it, there might be a surprising number of targets where 512 attempts is effective